CVEvulnerability

CVE-2026-17520

4.8 MEDIUM Published 2026-08-29 Modified 2026-08-31 Official page ↗
Status
Deferred
Published
2026-08-29
Last modified
2026-08-31
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
4.8 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Weaknesses
CWE-326

Description

The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value, allowing unauthenticated attackers to compute the key and perform privileged actions such as adding and deleting subscribers and sending emails, when the optional API has been enabled.

Related

Weakness · CWE (1)

  • CWE-326 Inadequate Encryption Strength weakness

References